PT-2022-19295 · Apache · Apache Jena

Amit Laish + 2 · Published 2022-05-05 · Updated 2023-10-25 · CVE-2022-28890

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Jena versions prior to 4.4.0

Description A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects versions prior to 4.4.0, excluding Apache Jena 4.2.x and 4.3.x, which do not allow external entities.

Recommendations For Apache Jena versions prior to 4.4.0, update to a version that is not affected by this issue. As a temporary workaround, consider disabling the RDF/XML parser until a patch is available. Restrict access to external DTDs to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-28890

GHSA-GCHV-364H-R896

Affected Products

Apache Jena

References · 14

• https://ubuntu.com/security/CVE-2022-28890 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-28890 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-28890 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-28890 · Security Note
• https://osv.dev/vulnerability/GHSA-gchv-364h-r896 · Vendor Advisory
• https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28890 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-28890 · Vendor Advisory
• https://t.me/cibsecurity/41966 · Telegram Post
• https://t.me/cvenotify/29709 · Telegram Post
• https://jena.apache.org/about_jena/security-advisories.html#cve-2022-28890---processing-external-dtds · Note
• https://openwall.com/lists/oss-security/2022/05/04/1 · Note
• https://gitbox.apache.org/repos/asf/jena.git · Note